Defender Actions and PUA¶
Two settings that decide what Defender does when it finds something, and whether it looks for the borderline stuff at all.
Default actions¶
Defender assigns each threat a severity (Low, Moderate, High, Severe) and has a default action for each. The actions are Clean, Quarantine, Remove, Block, or Allow. "Allow" means Defender finds malware and leaves it running.
Get-MpPreference | Select *ThreatDefaultAction
LowThreatDefaultAction : 6
ModerateThreatDefaultAction : 6
HighThreatDefaultAction : 2
SevereThreatDefaultAction : 2
| Value | Action |
|---|---|
| 1 | Clean |
| 2 | Quarantine |
| 3 | Remove |
| 4 | Allow (older name) |
| 6 | Allow |
| 8 | User defined |
| 9 | No action |
| 10 | Block |
Low and Moderate set to Allow means adware and downloaders run freely. Fix:
Set-MpPreference -LowThreatDefaultAction Quarantine -ModerateThreatDefaultAction Quarantine -HighThreatDefaultAction Quarantine -SevereThreatDefaultAction Quarantine
There's no GUI for this; it's PowerShell or Group Policy (Microsoft Defender Antivirus → Threats → Specify threat alert levels at which default action should not be taken when detected).
Potentially unwanted applications¶
PUA protection catches adware, software bundlers, cracking tools, and other things that aren't quite malware but have no business on a work machine. It's off by default in some builds.
Windows Security → App & browser control → Reputation-based protection settings → Potentially unwanted app blocking: On, with both Block apps and Block downloads ticked.
Set-MpPreference -PUAProtection Enabled
Policy: gpedit.msc → Microsoft Defender Antivirus → Configure detection for potentially unwanted applications: Enabled, Block.
Cloud protection¶
Cloud-delivered protection lets Defender check unknown files against Microsoft's service in real time and catches new threats before signatures exist. Virus & threat protection → Manage settings → Cloud-delivered protection and Automatic sample submission: both On.
Set-MpPreference -MAPSReporting Advanced -SubmitSamplesConsent SendAllSamples
Verify¶
Get-MpPreference | Select *ThreatDefaultAction, PUAProtection, MAPSReporting
All default actions 2, PUAProtection 1, MAPSReporting 2.